Technical impact
This vulnerability in Kiteworks, prior to version 9.2.0, allows administrators to upload any file type without validation, enabling the placement of malicious or unauthorized files on the server. The lack of file‑type checks opens the possibility for attackers to introduce scripts or executables that could later be used for data exfiltration or further compromise if such files are accessed or executed on the system. The weakness is a classic uncontrolled file upload.
Affected Systems
Affected systems include Kiteworks, a private data network product, specifically versions earlier than 9.2.0 in the core file‑upload component. Administrators or users with elevated privileges can trigger the issue.
Risk and Exploitability
The CVSS score is 4.9, indicating a low to moderate impact, and the EPSS score of 2% signals that exploitation is unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require administrative privileges on the Kiteworks instance; it does not appear to be remotely exploitable by external parties.
